We’re looking for a Security Engineer focused on Attack Surface Management (ASM) (Based in VANCOUVER OR TORONTO) to help identify, monitor, and reduce our retail clients digital exposure. This role looks at our environment from an attacker’s perspective—finding internet‑facing assets, misconfigurations, and weak points before they can be exploited.
You’ll work closely with Network, Cloud, Application, IT, and Security Operations teams to reduce risk across cloud, SaaS, on‑prem, OT/IoT, and third‑party environments.
You’ll work closely with Network, Cloud, Application, IT, and Security Operations teams to reduce risk across cloud, SaaS, on‑prem, OT/IoT, and third‑party environments.
What You’ll Do
Discover & Monitor Exposure
• Identify known and unknown assets, including cloud workloads, APIs, SaaS apps, OT/IoT devices, and third‑party integrations
• Maintain visibility into internet‑facing and internal assets, including shadow IT
• Track changes that introduce new exposure (new deployments, vendors, acquisitions)
Analyze & Prioritize Risk
• Identify attack paths, misconfigurations, and exploitable conditions
• Prioritize risks based on real‑world impact and likelihood—not just severity scores
• Clearly explain risk and remediation needs to stakeholders
Reduce Attack Surface
• Partner with engineering and operations teams to:
• Remove unused services
• Close unnecessary ports and endpoints
• Fix insecure configurations
• Improve access controls
• Validate that fixes actually reduce exposure
Collaborate Across Teams
• Act as a security partner to NetOps, Cloud, and Application teams
• Support secure design, deployment, and configuration practices
• Ensure ASM findings support SOC monitoring and incident response
Report & Improve
• Create clear dashboards and reports on exposure and remediation progress
• Identify recurring issues and drive long‑term improvements
• Stay current on attacker techniques and ASM best practices
What We’re Looking For
Required
• 2+ years of experience in security engineering, cybersecurity operations, or a related role
• Strong networking fundamentals (TCP/IP, DNS, firewalls, internet‑facing systems)
• Experience with attack surface management, vulnerability management, or security monitoring
• Familiarity with cloud platforms (AWS, Azure, or GCP) and SaaS environments
• Ability to communicate technical risk to both technical and non‑technical audiences
Nice to Have
• Experience with ASM / EASM or exposure management tools
• Background in application security, DevSecOps, or software supply chain security (SBOM)
• Exposure to SIEM, EDR/XDR, or SOC workflows
• Knowledge of OT/IoT or industrial environments
• Experience in large, distributed enterprise environments
